CVE-2020-37094
CRITICALEspoCRM 5.8.5 - Authentication Bypass via Authorization Header Manipulation
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2020-37094. PoCs published by Besim.
AI-analyzed exploit summary The writeup describes a privilege escalation vulnerability in EspoCRM 5.8.5 where manipulating the 'Authorization' and 'Espo-Authorization' headers allows an attacker to access other users' information. It includes technical details about the API request structure and encoding techniques.
Description
EspoCRM 5.8.5 contains an authentication vulnerability that allows attackers to access other user accounts by manipulating authorization headers. Attackers can decode and modify Basic Authorization and Espo-Authorization tokens to gain unauthorized access to administrative user information and privileges.
Exploits (1)
The writeup describes a privilege escalation vulnerability in EspoCRM 5.8.5 where manipulating the 'Authorization' and 'Espo-Authorization' headers allows an attacker to access other users' information. It includes technical details about the API request structure and encoding techniques.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H